Radware Cloud Security Services

Editor's Notes

• #7: http://www.gfi.com/blog/most-vulnerable-operating-systems-and-applications-in-2014/
• #8: http://savvyapps.com/blog/how-often-should-you-update-your-app http://www-03.ibm.com/software/businesscasestudies/lb/en/corp?synkey=C023976H17338X93 http://www-01.ibm.com/common/ssi/cgi-bin/ssialias?subtype=AB&infotype=PM&htmlfid=RAC14375USEN&attachment=RAC14375USEN.PDF#loaded https://www.quora.com/How-often-do-major-software-companies-push-code-to-production
• #9: http://www.hp.com/hpinfo/newsroom/press_kits/2014/RSAConference2014/Ponemon_IT_Security_Jobs_Report.pdf http://blog.vsoftconsulting.com/blog/what-does-an-understaffed-it-department-look-like
• #16: Real-Time Monitoring Across all Radware Security Modules 3rd Party Event Notifications Comprehensive Reporting Historical Reporting Engine Customizable Dashboards Advanced Forensics Reports Compliance Reports Ticket Work Flow Management Event Correlation Engine Role/User Based Access Control
• #19: Unmatched Enterprise-grade Web Security Protection The Hybrid Cloud WAF Service is based primarily on Radware's web application firewall – AppWall. Provides FULL coverage from ALL the OWASP top-10 attacks Is ICSA Labs certified Supports both negative and positive security models: Positive security policies are based on behavioral analysis technology. The security technology learns what the possible inputs per each web page are and what the typical values per each input field are. It then locks the policy to the allowed ranges of values. positive security profiles are a proven protection against zero-day attacks. Negative security policies are based on static signature detection technology. The WAF module stores a signature file that covers thousands of known application vulnerabilities and exploits that are checked against every user transaction. Once a signature match is found – the session is terminated and the attack is blocked Has the unique ability to generate policies automatically: Patent-protected technology to create and maintain security policies for the widest security coverage with the lowest false positives and lowest operational effort. A four step flow to create and maintain security policies – Application Mapping, Threat Analysis, Policy Generation, Policy Activation No other WAF can do that and it eliminates many of the complexities involved with setting up and configuring existing WAF solutions.
• #23: Major US Airline Experienced sophisticated attacks where bad bots were programmed to “scrape” certain flights, routes and classes of tickets. Bots were acting as faux buyers—continuously creating but never completing reservations on those tickets Resulting in the airline unable to sell the seats to real customers Invested in security protection but wasn’t able to differentiate between the “good” bots and the “bad” ones as the attackers dynamically changed the source IP. Chose Radware’s AppWall with fingerprinting technology to block dynamic IP attacks Lead example for need for Fingerprinting technology – blocking beyond source IP Emphasize the ability to differentiate between good and bad bots Highlight the challenges with source IP blocking with the growing dynamic IP attacks
• #27: This is another unique capability in Radware’s solution. We are able to detect attacks more accurately, with lower false positives, by using patent protected behavioral analysis algorithm. Using this, we can accurately differentiate between a spike of traffic that is legitimate (for example – a marketing campaign or promotion) and a spike of traffic that is illegitimate – an attack. Compare to a rate-based technology that simply blocks traffic above a certain rate and, in this way, blocks legitimate traffic as well, we will not block your legitimate traffic and allow users to access your applications during peak traffic times as they should.
• #33: Why do we start here? These customers already know Radware and enjoy our products and services. They are uniquely positioned to benefit from an integrated ADC and security solution – to really extend their Radware ADC into a full solution that helps ensure the availability and security of their applications. Offering Radware’s attack mitigation solution to these existing customers is all about promoting the hybrid, integrated and single-vendor solution. They will enjoy additional protection with a synchronized system that exchanged messaging between the ADC and attack mitigation devices to get the best possible protection. They will get a robust SSL solution that is unmatched in the industry. Look at DTCC – The US Depository Trust & Clearing Corporation is a financial services company that provides clearing and settlement services to the financial market. Today it settles the vast majority of security transactions in the US and operates multiple facilities in the US and outside as well. DTCC has been a Radware ADC customer for over 15 years and they were using Prolexic for DDos mitigation. However their encrypted HTTPS traffic was not protected. Radware was able to leverage the trust and partnership to sell them our attack mitigation solution that includes DefensePro and our SSL mitigation solution. They purchased a total of 10 boxes for 5 data centers globally for a total $1.1M deal size.
• #34: When an Attack Starts On-premise attack mitigation device (DefensePro) mitigates attacks in real-time without ERT involvement Defense Messaging DefensePro sends ‘pipe utilization’ messages to DefensePipe Defense Messages include also baselines and attack footprint so once diverted, the attack is immediately mitigated accurately – no learning curve Single Point of Contact Once a pre-defined threshold is reached, the ERT asks for the customer approval to divert the traffic to the cloud Attack is handled with the customer from inception at the customer’s premise
• #35: When an Attack Starts On-premise attack mitigation device (DefensePro) mitigates attacks in real-time without ERT involvement Defense Messaging DefensePro sends ‘pipe utilization’ messages to DefensePipe Defense Messages include also baselines and attack footprint so once diverted, the attack is immediately mitigated accurately – no learning curve Single Point of Contact Once a pre-defined threshold is reached, the ERT asks for the customer approval to divert the traffic to the cloud Attack is handled with the customer from inception at the customer’s premise
• #37: Why do we start here? These customers already know Radware and enjoy our products and services. They are uniquely positioned to benefit from an integrated ADC and security solution – to really extend their Radware ADC into a full solution that helps ensure the availability and security of their applications. Offering Radware’s attack mitigation solution to these existing customers is all about promoting the hybrid, integrated and single-vendor solution. They will enjoy additional protection with a synchronized system that exchanged messaging between the ADC and attack mitigation devices to get the best possible protection. They will get a robust SSL solution that is unmatched in the industry. Look at DTCC – The US Depository Trust & Clearing Corporation is a financial services company that provides clearing and settlement services to the financial market. Today it settles the vast majority of security transactions in the US and operates multiple facilities in the US and outside as well. DTCC has been a Radware ADC customer for over 15 years and they were using Prolexic for DDos mitigation. However their encrypted HTTPS traffic was not protected. Radware was able to leverage the trust and partnership to sell them our attack mitigation solution that includes DefensePro and our SSL mitigation solution. They purchased a total of 10 boxes for 5 data centers globally for a total $1.1M deal size.
• #38: When an Attack Starts On-premise attack mitigation device (DefensePro) mitigates attacks in real-time without ERT involvement Defense Messaging DefensePro sends ‘pipe utilization’ messages to DefensePipe Defense Messages include also baselines and attack footprint so once diverted, the attack is immediately mitigated accurately – no learning curve Single Point of Contact Once a pre-defined threshold is reached, the ERT asks for the customer approval to divert the traffic to the cloud Attack is handled with the customer from inception at the customer’s premise
• #40: Why do we start here? These customers already know Radware and enjoy our products and services. They are uniquely positioned to benefit from an integrated ADC and security solution – to really extend their Radware ADC into a full solution that helps ensure the availability and security of their applications. Offering Radware’s attack mitigation solution to these existing customers is all about promoting the hybrid, integrated and single-vendor solution. They will enjoy additional protection with a synchronized system that exchanged messaging between the ADC and attack mitigation devices to get the best possible protection. They will get a robust SSL solution that is unmatched in the industry. Look at DTCC – The US Depository Trust & Clearing Corporation is a financial services company that provides clearing and settlement services to the financial market. Today it settles the vast majority of security transactions in the US and operates multiple facilities in the US and outside as well. DTCC has been a Radware ADC customer for over 15 years and they were using Prolexic for DDos mitigation. However their encrypted HTTPS traffic was not protected. Radware was able to leverage the trust and partnership to sell them our attack mitigation solution that includes DefensePro and our SSL mitigation solution. They purchased a total of 10 boxes for 5 data centers globally for a total $1.1M deal size.
• #41: When an Attack Starts On-premise attack mitigation device (DefensePro) mitigates attacks in real-time without ERT involvement Defense Messaging DefensePro sends ‘pipe utilization’ messages to DefensePipe Defense Messages include also baselines and attack footprint so once diverted, the attack is immediately mitigated accurately – no learning curve Single Point of Contact Once a pre-defined threshold is reached, the ERT asks for the customer approval to divert the traffic to the cloud Attack is handled with the customer from inception at the customer’s premise
• #42: Link utilization thresholds by SNMP trap; MIB. Periodically sampled by our NOC every 1 min (configurable). Provides only throughput data. Threshold usually configured as 75% link utilization over 30 min. Flow statistics collected by our NOC. Router is configured to periodically sent to us (every 1 min.) the flow statistics. Thresholds allow some baselining of peacetime legit traffic, so volumetric attack detection is more granular. However, application-level attacks on specific resources is not available, such as SSL attacks that aim to starve SSL connection per second capacity, or HTTP DDOS.